/*
 * ObjectClassifier.c
 * VB Script Analyzer
 * @author Gregoire JACOB (gregoire.jacob@orange-ftgroup.com)
 * @date 07/04/2008
 * @version 1.0
 */

#include ".\Includes\Analyzer.h"

void ClassifyObject(char * name, unsigned long address, 
				   int * type, int * nature){
	int max = 0;
	
	if(name){
		switch(*nature){
			case OBJ_FILE:
				ClassifyFile(name,type,nature); return;
			case OBJ_REG:
				ClassifyRegKey(name,type,nature); return;
			case OBJ_NETW:
				*type = TYPE_COM; return;
			case VAR:
				*type = TYPE_VAR; return;
			default:
				//Checks for most significant types
				ClassifyFile(name,type,nature);
				max = *type; 
				ClassifyRegKey(name,type,nature);
				if(*type<max){*type = max; *nature = OBJ_FILE;} 
				return;
		};//switch
	}/*else{
		ClassifyAddress(address,type,nature);
	}*/
}

void ClassifyFile(char * name, int * type, int * nature){
	*type = TYPE_PERM;
	//Self reference
	if(strcasestr(name,procname)
		&&(strcasestr(name,"Dokumente und Einstellungen\\Administrator\\Desktop\\NtTrace\\")
		   ||!strchr(name,'\\'))){//Local directory
		*type =  TYPE_THIS;
	}
	//Configuration file
	if(strcasestr(name,RUN_FILE1)||
		strcasestr(name,RUN_FILE2)||
		  strcasestr(name,RUN_FILE3)||
		    strcasestr(name,RUN_FILER)){
		*type = TYPE_BOOT;
	}
	//Startup folder
	if(strcasestr(name,RUN_FOLD)){
		*type = TYPE_BOOT;
		*nature = OBJ_FOLD;
	}
	//Network drivers
	if(strcasestr(name,COM_DRIVE1)||
		strcasestr(name,COM_DRIVE2)||
		  strcasestr(name,COM_DRIVE3)||
			strcasestr(name,COM_DRIVE4)||
			  strcasestr(name,COM_DRIVE5)){
		*type = TYPE_COM;
		*nature = OBJ_NETW;
	}
	//Shared directory
	if(strcasestr(name,COM_FILE)){
		*type = TYPE_COM;
		*nature = OBJ_MAIL;
	}
	if(strcasestr(name,COM_FOLD1)||
		strcasestr(name,COM_FOLD2)||
		strcasestr(name,COM_FOLD3)||
		strcasestr(name,COM_FOLD4)||
		strcasestr(name,COM_FOLD5)||
		strcasestr(name,COM_FOLD6)||
		strcasestr(name,COM_FOLD7)){
		*type = TYPE_COM;
		*nature = OBJ_FOLD;
	}
}

void ClassifyRegKey(char * name, int * type, int * nature){
	*type = TYPE_PERM;
	//Run registry keys
	if(strcasestr(name,RUN_REG1)||
		strcasestr(name,RUN_REG2)){
		*type = TYPE_BOOT;
		*nature = OBJ_REG;
	}
}